Adobe Patches Critical Flaws in Connect and AEM Forms
Adobe has released security updates to address nine critical vulnerabilities affecting Adobe Connect and Adobe Experience Manager (AEM) Forms, potentially leading to code execution and privilege escalation.
Adobe has issued critical security updates to address a total of 36 vulnerabilities across its product suite, with a significant focus on critical flaws impacting Adobe Connect and Adobe Experience Manager (AEM) Forms. The patches aim to mitigate risks of arbitrary code execution and privilege escalation on affected systems.
The Adobe Connect update specifically resolves nine security defects. Among these are six critical vulnerabilities that could be exploited by attackers to achieve arbitrary code execution and gain elevated privileges. These critical issues are identified as SQL injection, cross-site scripting (XSS), and improper input validation flaws, tracked under CVEs CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, and CVE-2026-75698.
In addition to the critical vulnerabilities, the Adobe Connect patch also addresses high-severity issues including path traversal, improper certificate validation, and XSS weaknesses. Exploitation of these could lead to unauthorized access to file systems, bypass of security features, and potentially arbitrary code execution.
For Adobe Experience Manager (AEM) Forms, Adobe has patched six vulnerabilities, three of which are classified as critical. These critical flaws can lead to code execution and privilege escalation. The underlying causes are attributed to incorrect authorization, improper input validation, and server-side request forgery (SSRF) vulnerabilities, identified as CVE-2026-75745, CVE-2026-81995, and CVE-2026-82000.
The AEM Forms update also includes fixes for three high-severity vulnerabilities: SSRF, XSS, and cross-site request forgery (CSRF). Successful exploitation of these could result in privilege escalation, code execution, and security feature bypasses.
Both the Adobe Connect and AEM Forms security updates have been assigned a Priority 2 rating by Adobe. This classification indicates that users should apply these patches within the next 30 days to maintain a secure environment.
Beyond Connect and AEM Forms, Adobe also released fixes for multiple high- and medium-severity vulnerabilities in other products, including InDesign, Content Credentials SDK, Bridge, Substance 3D Modeler, and Premiere Pro. These vulnerabilities could lead to application denial-of-service (DoS), security feature bypass, arbitrary code execution, and memory exposure.
Adobe has stated that it is not aware of any of these newly patched security flaws being actively exploited in the wild. However, users are strongly encouraged to apply the updates promptly to protect their systems from potential future attacks. Further details and specific bulletin information can be found on Adobe's security bulletins page.